Black Box ET0010A, Руководство пользователя CLI, Страница: 59 / 212

Creating Policies
60 ETEP CLI User Guide
CAUTION
When you change the policy-mode of an in-service ETEP , all encrypt and drop policies currently installed
on the ETEP are removed. Traffic is sent in the clear until you create and deploy new policies.
To configure the policy mode on the ETEP :
1 Log in to the CLI as the Administrator user.
2 At the
admin
> prompt, type
configure
and press ENTER.
3 At the
config
> prompt, type
policies
and press ENTER.
4 At the
policies>
prompt, enter the following command. See Table 29 for a description of the
attributes.
policy-mode {<policy> <enable-CE>} [tls-clear]
Examples
This example configures the ETEP for Layer 2 point-to-point operation. Since the ETEP will be used in a
Layer 2 point-to-point policy, EncrypTight is disabled (false) and TLS-clear is false.
admin> configure
config> policies
policies> policy-mode layer2 false false
Layer 2 Policy Example
The example in Figure 6 shows a pair of ETEPs deployed in a Layer 2 point-to-point configuration. The
Administrator logs in and configures the management port, and then sets the date and time. After entering
policy configuration mode, the next two commands configure the Layer 2 policy and the policy mode,
specifying the ETEP to encrypt traffic at Layer 2, and use IKE negotiation to generate keys (disable
EncrypTight).
Table 29 policy-mode command description
attribute description
policy
{layer2 | layer3}
The policy setting determines whether the ETEP can be used in Layer 2 Ethernet or
Layer 3 IP policies. ETEPs that are configured for Layer 2 cannot be used in Layer 3
policies and vice versa.
enable-CE
{true | false}
The EncrypTight setting defines whether or not EncrypTight is used for policy
management. If you are creating a Layer 2 point-to-point policy, set the EncrypTight
attribute to false. For distributed key polices, set the EncrypTight attribute to true.
tls-clear
[true | false]
Passing TLS-based management traffic in the clear (true) is required for EncrypTight
distributed key policies, and when the ETEP is managed in-line. This is an optional
attribute that defaults to true when enable-CE is true.
When the ETEP is operating in Layer 2 point-to-point operation, the tls-clear setting is
false.